Running PHP 8.1 or Older? Here's How to Get PHP2Shell Patches

This week, government websites across Europe went dark. Germany pulled several federal sites offline, France temporarily shut down prefecture sites, and Belgium's foreign ministry disabled its web properties. Each organization was waiting on a fix for PHP2Shell, two newly disclosed PHP vulnerabilities that open the door to remote code execution. 

PHP security team was already in the process of a coordinated release, spanning around 100 distribution channels, and were 2 days from release when a leak forced them to move forward with patches, which were released on 10/21/2026.  

But if your applications run on PHP 8.1 or older, the PHP project isn't releasing a patch for you. That's where Zend comes in. We released PHP2Shell patches for key end-of-life (EOL) PHP versions — including PHP 7.2, 7.3, 7.4, 8.0, and 8.1, — so your team can get covered while you plan your next move. 

What PHP2Shell Is, and Why Patching Is the Only Fix

PHP2Shell is the name being used for two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both create remote code execution (RCE) risk through a combination of out-of-memory (OOM) conditions and the way PHP handles errors. Every PHP version back to 5.4 is affected by at least one of them. 

Wiz Research found that attackers could use these flaws to run code remotely or read sensitive data out of process memory, including: 

• Passwords 
• Authentication tokens 
• API keys 
• Certificates 

The detail that matters most for your defenses is where the vulnerable behavior lives. Datadog Security Labs independently reproduced CVE-2026-109618 and found that PHP processes the malicious request before your application code ever runs. Application-level authentication can't stop an attack that never reaches the application. Solid security practices in your code, framework, or CMS won't close this gap. The only real mitigation is a patched PHP runtime. 

Get PHP2Shell Patches for PHP Versions the Community no Longer Supports

The PHP Ecosystem Security Team, the PHP Foundation, and release managers worked with long-term support (LTS) vendors, including Zend, so every patch could land at the same time. As of 14:00 UTC on October 21, all community-supported PHP versions have updates that mitigate both vulnerabilities. Zend released patches for EOL PHP versions alongside them. 

If your team is on PHP 8.1 or older, here's how to get covered: 

1. Check your PHP version. Run php -v on your servers and containers. Anything on 8.1 or older no longer receives fixes from the PHP project. 
2. Talk to Zend about PHP LTS. Our PHP experts will walk you through your options for getting PHP2Shell patches. 
3. Apply the patches. Roll the patched runtime into your environments, starting with applications that handle sensitive data or face the public internet. 
4. Plan your move to a supported version. Patching buys you time. Use it to test your frameworks, extensions, and application code against a supported PHP release. 

Get PHP2Shell patches via Zend PHP LTS >>

PHP LTS Works as a Bridge to Modernization 

Upgrading sounds simple until you try it on a critical application. A new PHP runtime can mean updates to frameworks, libraries, extensions, and application code, plus the testing it takes to keep production stable. That takes time, and PHP2Shell won't wait for your project plan. 

You're also not alone in this gap. Zend's PHP Landscape Report estimates that 40% of PHP users run unsupported versions. PHP2Shell surfaced through OpenAI's Patch the Planet initiative, and OpenAI expects the pace of similar discoveries to climb quickly in the coming months. Node.js and Python also reported critical vulnerabilities the same day PHP2Shell landed. 

LTS gives your team a way to keep addressing security vulnerabilities while you plan, test, and execute a move to a supported version. Staying on unsupported software indefinitely gets harder to justify as discovery speeds up, but you don't have to rush an upgrade to stay secure in the meantime. 

PHP2Shell Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the name for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They create remote code execution risk through out-of-memory conditions and PHP's error handling.

Which PHP versions are affected by PHP2Shell?

Every PHP version back to 5.4 is affected by at least one of the two CVEs.

Do PHP 8.1 and older get community patches for PHP2Shell?

The PHP project applied patches to the PHP 8.1, 8.0, and 7.4 branches, but, critically, did not tag or compile releases. Users can download those and self-compile PHP, but would not be protected against other vulnerabilities issued against those versions post-EOL, nor later vulnerabilities.

Can my application's security stop PHP2Shell?

No. Datadog Security Labs found that PHP handles the malicious request before application code runs, so application-level authentication can't prevent the attack. Patching PHP is the fix.

How do I get PHP2Shell patches from Zend?

Contact Zend about PHP LTS. Our team will help you get PHP2Shell patches for your end-of-life PHP version so you can stay secure while you plan your upgrade.